CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- directusDirectus doesn't redact tokens in Flow logs4.5 Medium
- directusDirectus doesn't redact sensitive user data when logging via event hooks4.2 Medium
- dracoon security-advisoriesDRACOON Branding Service vulnerable to Cross-site Scripting4.0 Medium
- caidoCaido Toast Vulnerable to Reflected Cross-site Scripting6.3 Medium
- dokployDokploy's Preview Deployments are vulnerable to Remote Code Execution9.4 Critical
- labredescefetrj wegiaWeGIA ReflectedCross-Site Scripting (XSS) vulnerability in endpoint 'cadastro_pet.php' parameter 'msg'6.4 Medium
- labredescefetrj wegiaWeGIA vulnerable to SQL Injection (Blind Time-Based) in `processa_deletar_socio.php` parameter `id_socio`10.0 Critical
- labredescefetrj wegiaWeGIA vulnerable to Reflected Cross-Site Scripting in endpoint 'relatorio_geracao.php' parameter 'tipo_relatorio'6.5 Medium
- labredescefetrj wegiaWeGIA vulnerable to Open Redirect in endpoint 'control.php' parameter 'nextPage'4.7 Medium
- xwiki, xwiki xwiki-rendering +1 moreXWiki Rendering is vulnerable to RCE attacks when processing nested macros10.0 Critical
- xwiki, xwiki xwiki-rendering +1 moreXWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax9.1 Critical
- saleem-hadad larecipeLaRecipe is vulnerable to Server-Side Template Injection attacks10.0 Critical
- labredescefetrj wegiaWeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro'6.5 Medium
- nixos nixNix's privilege dropping to build user broke for macOS7.9 High
- github-kanban-mcp-servergithub-kanban-mcp-server Command Injection vulnerability8.9 High
- metersphereMetersphere has SQL Injection Vulnerability in Sorting Field5.1 Medium
- imagemagickImageMagick has Stack Buffer Overflow in image.c7.4 High
- imagemagickImageMagick has Memory Leak in magick stream3.7 Low
- aio-libs aiohttpAIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections1.7 Low
- imagemagickImageMagick has XMP profile write that triggers hang due to unbounded loop7.5 High
- cern indicoIndico vulnerable to user enumeration via API endpoint5.3 Medium
- yijiusmile kkfileviewofficeeditYiJiuSmile kkFileViewOfficeEdit deleteFile path traversal5.3 Medium
- imagemagickImageMagick has Heap Buffer Overflow in InterpretImageFilename3.7 Low
- shopify job-iterationJob Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class8.1 High
- yijiusmile kkfileviewofficeeditYiJiuSmile kkFileViewOfficeEdit fileUpload unrestricted upload5.3 Medium
- yijiusmile kkfileviewofficeeditYiJiuSmile kkFileViewOfficeEdit onlinePreview path traversal5.3 Medium
- yijiusmile kkfileviewofficeeditYiJiuSmile kkFileViewOfficeEdit download path traversal5.3 Medium
- gmg137 snap7-rsgmg137 snap7-rs Public API pthread_cond_destroy memory corruption5.1 Medium
- totolink t6, t6 firmware +1 moreTOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injection5.3 Medium
- totolink t6, t6 firmware +1 moreTOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection5.3 Medium
- totolink t6, t6 firmware +1 moreTOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injection5.3 Medium
- anisha mobile shopcode-projects Mobile Shop login.php sql injection6.9 Medium
- anisha wedding reservationcode-projects Wedding Reservation global.php sql injection6.9 Medium
- anisha electricity billing systemcode-projects Electricity Billing System change_password.php sql injection6.9 Medium
- code-projects simple shopping cartcode-projects Simple Shopping Cart register.php sql injection6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolkit: xml policy file with a large number of nested elements may lead to out-of-bounds write6.7 Medium
- code-projects simple shopping cartcode-projects Simple Shopping Cart userlogin.php sql injection6.9 Medium
- code-projects simple shopping cartcode-projects Simple Shopping Cart save_order.php sql injection6.9 Medium
- anisha avl roomscode-projects AVL Rooms city.php sql injection6.9 Medium
apportUbuntuapport regressionNo score- anisha avl roomscode-projects AVL Rooms profile.php sql injection6.9 Medium
- phpgurukul hospital management systemPHPGurukul Hospital Management System user-login.php sql injection6.9 Medium
- d-link di-8100, dlink di-8100 firmware +1 moreD-Link DI-8100 HTTP Request jingx.asp stack-based overflow8.6 High
- d-link di-8100, dlink di-8100 firmware +1 moreD-Link DI-8100 HTTP Request arp_sys.asp stack-based overflow8.6 High
- code-projects online library management systemPHPGurukul Online Library Management System student-history.php cross site scripting5.1 Medium
- code-projects online library management systemPHPGurukul Online Library Management System student-history.php sql injection5.3 Medium
- phpgurukul dairy farm shop management systemPHPGurukul Dairy Farm Shop Management System invoice.php sql injection5.3 Medium
- tenda ax1803, ax1803 firmware +1 moreTenda AX1803 setWifiFilterCfg formSetWifiMacFilterCfg stack-based overflow8.7 High
- tenda ax1803, ax1803 firmware +1 moreTenda AX1803 setMacFilterCfg formSetMacFilterCfg stack-based overflow8.7 High
- hewlett packard enterprise hpe autopass license server, hpe autopass license server +1 moreAn information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.7.5 High
- Show moreLoading…